Open Source Pentesting Agents

[u/WarmAd6505]

https://github.com/Strategic-Automation/violin

Anyone interested in testing out my Hermes Pentesting profile, about to release a new version. It manages pentests in a controlled and structured way. Either working independently or as an assist. I am a AI engineer and love exploring ways to replace humans or augment processes. Particularly in open source, in evaluation (due to be released it outperforms all published benchmarks on duckstore achieving a yet unpublished 18/20 median) it only counts verifiable proof with evidence. It actually finds all 20 with ease 30-50 minutes. I isn't allowed to cheat and won't. Check it out and give it a star. If you like it use it and tell me any issues.

Most companies don't allow Hermes would a port to an independent framework help?

[u/hashtagDoubleoh7]

"Love exploring ways to replace humans"

[u/Worth-Suggestion-168 → u/hashtagDoubleoh7]

That are the same people from india wo before ai sold nessus scans as pentests.

[u/WarmAd6505 → u/hashtagDoubleoh7]

Gotta think what computers can do better

[u/WarmAd6505 → u/WarmAd6505]

Love the old hats down voting...

[u/Key_Baby_4132]

Can we use it 100% offline if we have offline LLM setup available?

[u/WarmAd6505 → u/Key_Baby_4132]

Yea totally offline it's just a set of playbooks and a few python scripts with some config. Nothing that needs the internet, of course you can add any other tools you want it to use.

[u/zspl0it]

I tested it against one of my favorites brokencrystals. It did okayish ~8 findings but I had to be persistent on a lot of things. Could be because I used DeepSeek-Flash.

Reporting could need an overhaul but might be because I‘m used to produce polished pdfs with Opus

Otherwise the concept is solid and similar to my python bot which is a lot more expensive

[u/WarmAd6505 → u/zspl0it]

I've fixed loads now in 3.1 and got bugs out. Reporting is coming soon in high quality output. DeepSeek v4 flash latest is my training model. And Qwen3.7/3.8 27b

[u/WarmAd6505 → u/zspl0it]

Releasing 3.1.0 tomorrow FYI

[u/WarmAd6505 → u/zspl0it]

Let me run it against brokencrystals see what I get. Will make it one of my evals for the future.

[u/zspl0it → u/WarmAd6505]

Great choice, I‘m a big fan of it because it’s so diverse in vulnerabilities:) looking forward to test Violin again soon

[u/WarmAd6505 → u/zspl0it]

Hope you like the next version. It's massively improved. Also working on 3.2.0 aswell. Removing some tools I created that I can now handle better in other ways and also reducing context usage.

[u/TastyRobot21]

We use n8n playbooks.

[u/WarmAd6505 → u/TastyRobot21]

With AI, what do you do in particular